CVE-2025-21804

In the Linux kernel, the following vulnerability has been resolved:

PCI: rcar-ep: Fix incorrect variable used when calling devm_request_mem_region()

The rcar_pcie_parse_outbound_ranges() uses the devm_request_mem_region() macro to request a needed resource. A string variable that lives on the stack is then used to store a dynamically computed resource name, which is then passed on as one of the macro arguments. This can lead to undefined behavior.

Depending on the current contents of the memory, the manifestations of errors may vary. One possible output may be as follows:

$ cat /proc/iomem 30000000-37ffffff : 38000000-3fffffff :

Sometimes, garbage may appear after the colon.

In very rare cases, if no NULL-terminator is found in memory, the system might crash because the string iterator will overrun which can lead to access of unmapped memory above the stack.

Thus, fix this by replacing outbound_name with the name of the previously requested resource. With the changes applied, the output will be as follows:

$ cat /proc/iomem 30000000-37ffffff : memory2 38000000-3fffffff : memory3

[kwilczynski: commit log]

This flaw, rated low severity by Red Hat Product Security, affects the Renesas R-Car PCIe endpoint driver in the Linux kernel. In rcar_pcie_parse_outbound_ranges(), a dynamically computed resource name stored in a stack buffer is passed to the devm_request_mem_region() macro, which can lead to undefined behavior. Depending on the current contents of memory, the resource names reported in /proc/iomem may be empty or contain garbage, and in very rare cases, if no NULL-terminator is found in memory, the string iterator can overrun the stack buffer and access unmapped memory above the stack, causing a system crash. The issue is limited to systems using the R-Car PCIe endpoint driver on Renesas R-Car SoC hardware, and Red Hat's CVSS assessment (3.3, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) reflects a local attack vector with low availability impact only. Red Hat's low rating is lower than the NIST score of 5.5 (moderate) and the CVE.org score of 7.1 (important). All Red Hat Enterprise Linux and Red Hat In-Vehicle OS streams in this record are currently recorded as not affected; for Red Hat In-Vehicle OS, the recorded justification is that the vulnerable code is not present.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.